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DECLARATION OF MICHAEL BANDEMER 


I, Michael Bandemer, declare as follows: 

1. In July 2022, Berkeley Research Group, LLC (“BRG”’) was engaged by 
Skyryse, Inc. through its outside counsel Latham & Watkins LLP, to conduct a 
forensic analysis of electronically stored information (“ESI”). 

2. This report is based upon information currently known to me. I reserve 
the right to rely upon additional information that becomes available to me after the 
date of this report, and to amend, supplement, or modify this report to reflect such 
information or if further research or analysis warrants. I reserve the right to present 
demonstrative exhibits and/or visual aids to help explain my opinions at trial. 

Ji My billing rate is $610 per hour. My compensation does not depend on 
the outcome of this litigation. 

4. I am a Managing Director with BRG, and the national practice leader 
of BRG’s Discovery and Forensic Technology Services group. That practice group 
provides, among other things, consulting and expert services in the area of computer 
forensics, electronic discovery, and other associated technology advisory services to 
corporations, law firms, and governments in the United States and abroad. 

3. I have more than 20 years of experience in investigations, technology, 
and forensic matters. I advise both corporate clients and law firms on information 
technology, digital forensics, and e-discovery issues. I have served as the lead 
investigator in over a thousand matters and performed or supervised the forensic 
collection and analysis of ESI from corporate networks, databases, personal 
computers (Mac and PC), phones, tablets, external storage devices, internet, and 
other digital storage media. I am regularly retained as a business consultant and 
expert for litigation matters to examine computer evidence for the purpose of 
identifying, recovering, analyzing, explaining, and reporting the observed activity 


and the state of the evidence. 


Case 2:22-cv-09094-GW-MAR Document 454 Filed 04/24/23 Page 3of15 Page ID #:6949 


— 


C0 WH ANI Dn FP W WN 


10 


6. Attached as Exhibit C1 is my current curriculum vitae. My CV contains 
a full description of my educational background, professional achievements, 
qualifications, publications, and prior expert testimony. 
I. Summary of Conclusions 

A. Alex Wang 

Te Using digital forensics tools and analysis I was able to recover or match 
275 of the 277 files that FTI identified Mr. Wang as having deleted after the filing 
of Moog’s complaint. The two unrecovered files appear from their metadata to be 
similar to files that I did recover. I also re-analyzed Mr. Wang’s deletion activity 
from that period and identified another seven files that FTI had not previously 
identified. These additional files were either recovered or did not contain user- 
generated content. 

B. ‘Tri Dao 

8. Using digital forensics tools and the Ivanti Log produced by Moog, I 
identified the 39,278 files copied from Tri Dao’s Moog laptop to external USB 
storage devices. Many of these files are related to commercially available third-party 
products. I also identified the 7,679 files copied from Mr. Dao’s external USB 
storage device to his Skyryse laptop which are all related to Arduino, an open-source 
prototyping software for microcontrollers. Mr. Dao only opened two of the 7,679 
files which are two python programming scripts and I understand from Mr. Baer’s 
declaration that these do not appear to be Moog confidential or proprietary 
information. Baer Decl. Jj 93-94. 

C. Eric Chung 

9. I identified the 11 RBT spreadsheets in Mr. Pixley’s declaration and I 
understand further analysis of those spreadsheets can be found in Mr. Baer’s 
declaration. Baer Decl. {] 63-65. Mr. Baer’s declaration analyzes several zip files 
with ASTE related files that Moog claimed were its non-public information 


downloaded by Alin Pilkington. But the creation date of the relevant ASTE zip file 
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was May 13, 2011, which I understand from Moog’s complaint is prior to Mr. 
Pilkington worked at Moog. The last modified dates for the files in the ASTE zip 
file range from June 2007-May 2011 which I understand from Moog’s complaint is 
before Mr. Pilkington worked at Moog. 

D. Reid Raithel 

10. I reviewed the Ivanti Log from Reid Raithel’s Moog laptop and 
identified files copied to USB 2. Of these files, the file referenced in paragraph 47 
of Mr. Pixley’s declaration was copied to USB Drive 2. The logs on Mr. Raithel’s 
Skyryse laptop that record the disks and volumes connected to it do not indicate a 
device like USB 2 was connected to Mr. Raithel’s Skyryse laptop. 

II. Alex Wang Analysis 

11. Ihave reviewed the declaration of Bruce Pixley dated March 16, 2023. 
From my review of it, I understand Mr. Pixley did not provide an opinion on 
recovery or deletion of files including those deleted by Alex Wang. 

12. I have reviewed court filings showing that in April 2022, Skyryse 
alerted Moog and the Court that one of its employees, Alex Wang, deleted 
potentially relevant information from his Skyryse laptop after receiving a litigation 
hold notice. Dkt. 156 at 10-16. Skyryse engaged a digital forensic firm, FTI, to 
investigate the deletion activity and to attempt to recover the deleted files. /d. at 11. 
FTI determined that Mr. Wang had attempted to delete 277 files. /d. at 12-14. Of 
these files, FTI determined that 233 files related to the videogame The Witcher 3. 
Id. at 13. FTI found these files in Mr. Wang’s recycle bin and was able to recover 
them. /d. at 14. FTI determined that Mr. Wang had emptied the 44 remaining files 
from his recycle bin. /d. at 12. FTI was able to recover 12 of those 44 files and, 
based on examining those files, determined that they appeared to contain Skyryse 
information. Jd. As of June 14, 2022, there were 32 files from the original list of 
277 that FTI was unable to recover. Jd. 


13. I spoke with individuals from FTI to get an understanding of the work 
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it had performed. I then re-performed the forensic analysis of the 277 files identified 
by FTI to attempt to recover them. In addition to analyzing the deleted files 
identified by FTI, I also re-analyzed Mr. Wang’s recycle bin deletion activity. 

14. As part of my analysis, I reviewed the recovered files and also 
performed additional research regarding the types of files that I recovered. Nearly 
all of the 44 non-videogame files that I recovered appear to be related to CAD, or 
computer-aided design, drawings of wiring schematics. 

15. Lunderstand that Mr. Wang was employed by Skyryse as an electrical 
engineer. Based on my review of his computer I have confirmed that he used a 
program called TurboCAD to create numerous drawings of wiring schematics. 
TurboCAD creates CAD drawings with .tcw file extensions. I did not observe 
evidence of deletion of any .tcw files from Mr. Wang’s laptop after March 8, 2022, 
which is the date on which I understand Moog served its complaint on Skyryse. The 
vast majority of the non-videogame files that I recovered were files with the 
extensions .bak and .pdf, which I understand likely relate to the CAD drawings with 
the .tcw file extensions. According to page 236 of the TurboCAD user guide manual, 
when a CAD drawing is edited and saved in TurboCAD, the program automatically 
creates a backup file of the drawing with a .bak file extension and by default the 
backup file is saved in the same folder as the original drawing. See Exhibit C2 
(Excerpt of 2021 TurboCAD User Guide). A CAD drawing can also be saved or 
printed as a PDF using TurboCAD so that the file can be emailed or viewed outside 
of the TurboCAD program. Files with .bak and .pdf extensions that were created 
from native .tcw files would likely contain information that is duplicative of the 
information contained in the native file at that point in time. 

A. — Recovery of Files — FTI List 

16. I attempted to recover the 277 files identified by FTI in June 2022. I 


performed this work by extracting the files directly from unallocated or unused space 
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of the hard drive and from Volume Shadow Copies! found on Mr. Wang’s Skyryse 
computer and by using file metadata, including, for example, file signatures, file 
names, file sizes, and file created/modified dates to locate the files on Mr. Wang’s 
Skyryse computer or Google Drive. 

17. BRG identified 4 volume shadow copies on Mr. Wang’s Skyryse 
computer; the earliest volume shadow copy was created on April 5, 2022. BRG 
accessed the volume shadow copies using EnCase, an industry standard forensic 
software program, and exported the files that were deleted from the recycle bin. 
Exhibit C3 attached to this report provides a complete listing of the files that 
I analyzed. 

18. Based on this work, I confirmed that 233 of the 277 files related to the 
videogame The Witcher 3 and that they remained in Mr. Wang’s recycle bin and 
were recoverable. That left 44 files remaining from FTI’s list. I first analyzed 12 
files that FTI identified as recovered in June 2022. Dkt. 156 at 12. 

19. I was able to recover 10 of these 12 files directly from Mr. Wang’s 
Skyryse laptop and confirm that they appear to contain wiring schematics. The two 
other files that I recovered were corrupted files (Files 40 and 46). BRG was unable 
to open these files. Files may be corrupted for various reasons such as software errors 
that occur when a file is opened, or when a disk is malfunctioning or when portions 
of a deleted file are overwritten. 

20. The two corrupt files that I recovered were .bak files. They contain file 
signatures” that appear to be intact and match those of other similar .bak files 
generated by TurboCAD.’ Using the metadata from these two files I was able to 
' A volume shadow copy is a snapshot in time of a volume (e.g., C: drive) that is 
automatically Bed by Windows at periodic intervals or i gered by changes 


in the volume such as the installation of a new geen A volume shadow copy 
allows the entire volume to be reverted to when the snapshot was created. 


* A file signature consists of the first few bytes of data saved in a file that designate 
ie ate type. The file signature is found within the first 20 bytes of file saved in 
indows. 


> TurboCAD is a software application for 2D and 3D design and drafting. 
6 
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identify the source CAD drawings for these .bak files. See Exhibit C4. 

21. File 40 (SREBOFEV.bak) was created on February 16, 2022, and on 
the same day the TurboCAD file “WiringDiagram4.TCW” was opened. The 
“WiringDiagram4.TCW” file’s last modified timestamp (February 16, 2022, at 
23:14:08 UTC) matches the $REBOFEV.bak file’s last accessed timestamp 
(February 16, 2022 at 23:14:08 UTC) which is consistent with the automatic backup 
process performed by TurboCAD when a file is saved multiple times during an 
editing session. This corresponding native CAD drawing is still located on 
Mr. Wang’s computer. I understand this file has been made available to Moog in 
discovery. 

22. File 46 ($RQOR2AC.bak) was created on March 7, 2022, at 20:08:04 
UTC. On this day, the TurboCAD file “E101 REV_A.tcw” was opened at 19:50:43 
UTC and “E101 REV A Pl.tcw” was opened at 19:57:07 UTC. Neither the of 
these files exists on Mr. Wang’s computer. However, I saw no evidence of deletion 
of .tcw files from Mr. Wang’s computer. 

23. I was also able to recover the majority of the 32 files that FTI had been 
unable to recover as of June 2022. I recovered 22 of these files directly from the 
unallocated space or volume shadow copies on Mr. Wang’s computer. See Exhibit 
C3. These files included 21 files that appear to be related to wiring schematics and 
one .mp4 file that appears to be a blank video (i.e., like it was recorded by a camera 
with a cap over the lens). I understand these files have been or will be made available 
to Moog in discovery. 

24. The remaining 10 files consisted of three .bak files* and seven .pdf files 
that were created on Wang’s Skyryse laptop between February 23, 2022 and 
March 16, 2022. These files were all deleted from Mr. Wang’s recycle bin sometime 
on or after March 25, 2022. The original filenames are not known. The current 


filenames are a result of an automatic process that occurs when a file is sent to the 


“Files 34, 36, 37, 38, 41, 42, 44, 45, 47, 48. 
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Recycle Bin which renames files to a random name beginning with the $R 
characters. BRG compared the date timestamps of the 10 unrecovered files to file 
activity surrounding that time frame on the Skyryse laptop to attempt to match these 
unrecovered files to other files existing on Mr. Wang’s computer or Google Drive. 
See Exhibit C4. By analyzing the surrounding user activity BRG was able to match 
8 out of 10 unrecovered files to other files containing similar characteristics such as 
filename, date timestamps, and file size on Skyryse’s systems, and I understand these 
8 matching files have been or will be made available to Moog in discovery. The 2 
unmatched .pdfs, which appear to be similar to other files that I was able to match, 
do not appear to have been opened or accessed by Mr. Wang. 

25. For the three .bak files, I was able to locate native copies of the .tcw 
files from which they were created, either on Mr. Wang’s computer or his Google 
Drive account. I understand these native .tcw files have been made available to 
Moog in discovery. 

26. File 37 (6$RCW326T.bak) was created on February 23, 2022, and was 
last accessed on February 25, 2022, at 03:07:34 UTC. User activity indicates that 
the “Harness System Interconnect Diagram.tcw” file contains a matching last 
modified date timestamp (February 25, 2022 at 03:07:34) which suggests that 
TurboCAD — generated $RCW326T.bak as  a_ backup file when 
“Harness _System_Interconnect_Diagram.tcw” was opened in TurboCAD. I located 
a copy of the “Harness System _Interconnect_Diagram.tcw” file on Mr. Wang’s 
Google Drive. I understand this file has been made available to Moog in discovery. 

27. File 36 ($SRAFAODZ.bak) was created on March 8, 2022, and last 
accessed on March 12, 2022, at 02:06:00 UTC. User activity indicates that the 
“DATA_HARNESS_E_SIZE.tcw” file contains a matching last modified date 
timestamp (March 12, 2022, at 02:06:00 UTC) which suggests that TurboCAD 
generated $RAFAODZ.bak as a backup file when 
“DATA HARNESS E_ SIZE.tcw” was opened in TurboCAD. I located a copy of 
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“DATA HARNESS E_ SIZE.tcw” on Mr. Wang’s computer. I understand this file 
has been made available to Moog in discovery. 

28. File 44 (SRLQGPEI.bak) was created on March 11, 2022, and last 
accessed on March 16, 2022, at 01:54:43 UTC. User activity references 2 
TurboCAD drawings opened from Mr. Wang’s computer that contain a matching 
timestamp. “E101 REV_A EMA HARNESS.tcw” and 
“E101 REV_A EMA HARNESS old.tcw” both have a last modified timestamp 
of March 16, 2022, at 01:54:43 UTC. Both records of the drawings indicate the files 
contain the same file size and the same file creation date of February 24, 2022, at 
18:59 UTC. This evidence suggests that TurboCAD generated $RLQGPEI.bak as a 
backup file when “E101 REV_A EMA HARNESS.tcw” or 
“E101 REV_A EMA HARNESS old.tcw” was opened in TurboCAD. I located a 
copy of “E101 REV_A EMA HARNESS.tcw” on Mr. Wang’s Google Drive and 
a copy of “E101 REV A EMA HARNESS old.tew” on his computer. I 
understand these files have been made available to Moog in discovery. 

29. For five of the seven .pdf files I was able to use file sizes, creation dates, 
and access dates to match them to other .pdf files located on Mr. Wang’s computer 
or his Google drive. 

30. File 42 (S$RK85BFZ.pdf) was created on March 12, 2022, at 00:18:00 
UTC on Mr. Wang’s computer. User activity records reference a pdf file named “ 
BUX EKIt S - 56 hRLilyflute Cover.pdf’ that was also created on March 12, 2022, 
at 00:18:00 UTC on Mr. Wang’s computer. This evidence suggests that “#(= BK It 

- 52 hLilyflute Cover.pdf’ and $RK85BFZ.pdf are copies of the same file. I 
located a copy of “@IXBKIFS - SEB hkLilyflute Cover.pdf’ in Mr. Wang’s 
Skyryse email as an attachment, which I understand has been made available to 
Moog in discovery. 

31. File 38 (SRDCFMOT.pdf) was created and last modified on 
March 12, 2022, at 01:02:39 UTC. Two pdf files 
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(“EXAMPLE E101 REV A EMA HARNESS draft.pdf”’ and 
“E101 REV_A EMA HARNESS draft.pdf’) were also created and last modified 
on March 12, 2022, at 01:02:39 UTC on Mr. Wang’s computer. Both files also 
contain the same file size (1128625 bytes) as File 38. This evidence suggests that 
“EXAMPLE E101 REV A EMA HARNESS draft.pdf’, 

“E101 REV_A EMA HARNESS draft.pdf’, and $RDCFMOT.pdf are copies of 
the same file. I located a copy of 
“EXAMPLE E101 REV _A EMA HARNESS draft.pdf’ as an attachment in Mr. 
Wang’s email account. I also located a copy of 
“E101 REV _A EMA HARNESS draft.pdf” in the Slack application. I understand 
both of these files have been made available to Moog in discovery. 

32. File 48 (SRTRHG74.pdf) and File 45 (SRPAFI13.pdf) were both 
created on March 16, 2022, at 17:48:11 UTC. Forensic records indicate that another 
file, “E101 A EMA HARNESS.pdf”’ file was created in multiple locations around 
the same time, including on March 16, 2022, at 17:51:14 UTC, at 18:02:49 UTC, 
and at 18:22:41 respectively.” This evidence suggests that $RTRHG74.pdf and 
$RPAFI13.pdf are the copies of the same files as “E101_A EMA HARNESS. pdf.” 
I located all three copies of “E101_A EMA HARNESS.pdf’ on Mr. Wang’s 
computer. I understand all three copies have been made available to Moog in 
discovery. 

33. File 34 (SROHUXP5.pdf) was created on March 16, 2022 at 17:51:14 
UTC and was last modified on March 16, 2022, at 18:00:49 UTC and has a file size 
of 964911 bytes. User activity on Mr. Wang’s computer references a file 
(“C:\Users\Alex Wang\Desktop\temp print\E101 A EMA HARNESS.pdf’) that 
was created on March 16, 2022, at 17:51:14 and also last modified on March 16, 
2022, at 18:00:49 and also has a matching file size of 964911 bytes. This evidence 
> I was unable to determine a “created on” date for this file from Mr. Wang’s user 


activity. That is likely because he never opened the file and, therefore, no such data 
was generated in his log of user activity. 


10 
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suggests that “E101 A EMA HARNESS.pdf’ and $ROHUXPS.pdf are copies of 
the same file. I located a copy of “E101 A EMA HARNESS.pdf’ on Mr. Wang’s 
computer. I understand this file has been made available to Moog in discovery. 

34. There were only two files from FTI’s list of 277 files that I was not able 
to recover or match. Based on the forensic artifacts I reviewed, however, it appears 
likely these files are related to other files that I was able to recover or match. 

35. File 41 (SRIQYKOX.pdf) was created on March 11, 2022, at 23:43:14 
UTC on Mr. Wang’s computer. Internet records indicate that on March 11, 2022, at 
23:43:14 UTC a “.pdf’ file was downloaded from the internet and saved to the 
location “C:\Users\Alex Wang\Downloads\# FHI 4% S05Kk& - Lilyflute cover.pdf.” 
I was not able to locate the March 11 copy of “EMMIS - Lilyflute 
cover.pdf’ on Mr. Wang’s computer. However, I did locate a copy of a file named “ 
@LIX BRIT S - SEE hLilyflute Cover.pdf” that Mr. Wang downloaded on March 12. 
See supra ¥ 30. 

36. File 47 (SRR6YNY0.pdf) was created on March 16, 2022, at 17:46:18 
UTC. User activity indicates that the file “E101 A EMA HARNESS _1.pdf’ was 
accessed on Mr. Wang’s computer on March 16, 2022, at 17:46:18 UTC. I was 
unable to locate a copy of “E101_A EMA HARNESS _l.pdf’ on Mr. Wang’s 
computer. However, I did locate multiple copies of files beginning with 
“E101 A EMA HARNESS” on Mr. Wang’s computer. See supra Jf] 32-33. I 
understand those files have been made available to Moog in discovery. 

37. In summary, I was able to recover or match 275 of the 277 files that 
FTI identified Mr. Wang as having deleted from his Skyryse computer after the filing 
of Moog’s complaint. Moreover, the two files I was unable to recover or match 
appear likely similar to the many files I was able to recover. 

B. Analysis of Alex Wang Deletion Activity 

38. In addition to analyzing the deleted files identified by FTI, I also re- 
analyzed Mr. Wang’s recycle bin deletion activity. In addition to the 277 files 


11 
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identified by FTI, I also identified another seven files or folders that had been sent 
to Mr. Wang’s recycle bin (284 total). These seven files included one forensic 
artifact that referred to a recovered file, four folders, 2 of which are related to a video 
game and 2 that appear to have been empty when deleted, and two files, a system 
file and an application installation file that do not hold user content. FTI may have 
excluded these files from its initial count for those reasons. 

39. File 1 (SIBHMXLB.pdf) was created on March 22, 2022. This file is 
a computer artifact that refers to the location ‘“C:\Users\Alex 
Wang\Desktop\E101 REV A EMA HARNESS draft.pdf.” I located a copy of 
this file on Mr. Wang’s Google Drive. See supra § 31. 

40. Folders 35 (SR7MGLDS5) and 39 (S$RDSHJUS5) were created on 
March 12, 2022 and March 4, 2022 respectively. These folders appear empty and 
did not contain any files at the time they were deleted. 

41. Folders 297 (gamesaves) and 59 (The Witcher 3) were created on 
March 28, 2022. These folders contained the Witcher 3 videogame files described 
above supra § 13. 

42. File 63 (desktop.ini) was created on March 17, 2022. This file is a 
system file that is hidden from the user and does not contain user content. Rather, it 
is used by the system to customize the way in which a Windows folder is displayed. 

43. File 2 (SOLIDWORKS 2021 SP5.1.zip) was created on March 21, 
2022. This file is a SolidWorks application installation file that does not contain 
user content. Rather, it is used to install the SolidWorks program on a user’s 
computer. 

Il. Tri Dao 

44. I have reviewed the Ivanti log produced by Moog that allegedly 
represents the transfer of files from Tri Dao’s Moog issued computer to external 
USB storage devices. I identified the 39,278 files copied to the external USB device 


as referenced in Mr. Pixley’s March 16" declaration. 
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45. Of the 39,278 files copied to the external USB drive, 3,299 files are 
found within the “Atmel Microcontroller” folder. My research, which includes 
reviewing publicly available information, indicates that an Atmel Microcontroller is 
a commercially available third-party product that can be used in electronic projects. 
An additional 9,525 files are found within a “CircuitPython” folder. My research 
indicates that CircuitPython is a programming language used to learn to code on 
low-cost microcontroller boards. An additional 4,137 files are found in a 
“MyArduino” folder. Arduino is a commercially available third-party platform 
often used by hobbyists to create electronic projects. Another 4,327 files are found 
in a “HDHomerun” folder. HDHomeRun is a third-party product designed to allow 
individuals to watch live and recorded television programs on a computer network. 
Another 5,600 files are found in a “Ballard Drivers” folder. A driver is a set of 
instructions that allows a computer to understand how to use a device that is 
connected to it. For example, a printer driver must be installed on a computer before 
a printer can be used to print a file. Mr. Pixley does not specify which if any of the 
39,278 files contain alleged confidential or proprietary data owned by Moog nor 
does it appear that he has done anything to determine whether any of the files contain 
such Moog confidential or proprietary data. I understand from Mr. Baer’s 
declaration that these do not appear to be Moog confidential or proprietary 
information. Baer Decl. 4 93-94. 

46. Mr. Pixley states in paragraph 21 of his March 16™ declaration that 
7,679 files of the 39,278 files that were copied to an external USB device were later 
copied to Tri Dao’s Skyryse issued computer on February 15, 2022. The files copied 
to the Skyryse laptop are all found within a “MyArduino” folder. The vast majority, 
7,366 files, are found within a “My Tutorials” subfolder. Mr. Pixley does not 
indicate which if any of these files contain alleged Moog confidential or proprietary 
information nor does it appear that he has done anything to determine whether any 


of the files contain Moog confidential or proprietary data. I understand from Mr. 
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Baer’s declaration that these do not appear to be Moog confidential or proprietary 
information. Baer Decl. Jj 93-94. 

47. The only two files that were opened from the “C:\temp\MyArduino” 
folder are ps Python programming scripts 
(“C:\temp\MyArduino\Python\THS720A.py” and 
“C:\temp\MyArduino\Python\THS720 test.py”). 

48. I understand from Mr. Pixley’s declaration and emails produced by 
Moog that Mr. Pixley did not consider Moog’s investigation of Tri Dao’s devices by 
Ian Bagnald in January 2022. See MOOG0020055. I understand that Moog 
undertook an investigation in January 2022 and determined that the data transfers 
were related to Mr. Dao’s work at Moog and deemed appropriate. Jd. 

IV. Eric Chung 

49. Inparagraph 16 of Mr. Pixley’s March 16" declaration, he identifies 11 
Excel spreadsheets located on Eric Chung’s Skyryse issued computer with an 
application metadata creation date of June 6, 2015, and that 9 of these Excel 
spreadsheets were modified after March 11, 2022. I understand further analysis of 
the 11 spreadsheets can be found in Mr. Baer’s declaration. Baer Decl. {[ 63-65. 

50. In Mr. Baer’s declaration, he analyzes several zip files from Eric 
Chung’s Moog laptop (A0016) (“MOOOG-04208.A0016.Container/Bravo 2 — Gen 
Purpose/root/ALIN (Thumbdrive 12:2:2018)/Alin’s Stuff/ASTE-1.zip”). The file 
created date for this zip file is May 13, 2011. In this instance, it indicates when the 
contents of the zip were packaged together. The files included within the zip file do 
not have a file created date associated with them as this piece of metadata is lost 
when the items are packaged into a zip file. Each file included within the zip file 
does retain the last modified date which indicates the last time the file was modified 
before being packaged in the zip file. The last modified dates for the files included 
in the ASTE-1.zip file range from June 10, 2007 to May 13, 2011 which I understand 


from Moog’s complaint is before Alin Pilkington worked at Moog on or around July 
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V. Reid Raithel 

51. I analyzed Reid Raithel’s Moog laptop and confirmed there were two 
Samsung USB hard drives connected to this laptop with serial numbers 
8073E7654321 (which Moog refers to as “USB 1”) and CF1798654321 (which 
Moog refers to as “USB 2”). The Ivanti Log from Mr. Raithel’s Moog laptop 
indicates that over 27,000 files were copied to USB 2. Of these files, the file 
referenced in paragraph 47 of Mr. Pixley’s declaration was copied to USB Drive 2 
which was connected to Mr. Raithel’s Moog laptop on January 4, 2022. 

52. I understand from Mr. Pixley’s declaration that Raithel left USB 1 at 
Moog. I reviewed the logs on Mr. Raithel’s Skyryse laptop that record the disks 
and volumes connected to it. The logs contain disk and volume history that extend 
between January 10, 2022 and April 8, 2022. The logs contain no indication that a 
device like “USB 2” was ever connected to Mr. Raithel’s Skyryse laptop. 

53. I understand from Mr. Pixley’s declaration and emails produced by 
Moog that Mr. Pixley did not consider Moog’s investigation of Reid Raithel’s 
devices by Ian Bagnald in January 2022. See MOOG0020059. I understand 
Mr. Pixley provided an opinion that it could not be known what was transferred from 


Mr. Raithel’s Moog laptop. 


I declare that the foregoing is true and correct under penalty of perjury under 
the laws of the United States of America. 


Executed on this 24th day of April, 2023. 


ee 
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~ Michael Bandemer 


15 


